CVE-2026-23704: Six Apart Ltd Movable Type Advanced Software Edition

Medium severity, CVSS 5.1. EPSS: 0.2% chance of exploitation in the next 30 days.

A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

Affected products

• Six Apart Ltd Movable Type Advanced Software Edition
• Six Apart Ltd Movable Type Cloud Edition: version 9.0.5 (9 series) only; version 8.8.1 (8 series) only
• Six Apart Ltd Movable Type Premium Advanced Edition Software Edition
• Six Apart Ltd Movable Type Premium Cloud Edition: version 9.0.5 (9 series) only
• Six Apart Ltd Movable Type Premium Software Edition
• Six Apart Ltd Movable Type Software Edition

Published 2026-02-04. Last modified 2026-06-17.